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A proper Demand for Internationa! Preliminary Examination was made by the 19th month from the earliest claimed priority date. 
A copy of the International Application as filed (35 U.S.C. 371 (c)(2)) 

a. [X ] is transmitted herewith (required only if not transmitted by the International Bureau). 

b. [ ] has been transmitted by the International Bureau. 

c. [ ] is not required, as the application was filed in the United States Receiving Office (RO/US). 
A translation of the International Application into English (35 U.S.C. 371(c)(2)) 
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independent claims 
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IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 
In re Application of ' Atty. Docket 

STEFAN PHILIPP PHD 99-100 

Serial No. 

Filed: Concurrently 

ENCODING METHOD FOR CARRYING OUT CRYPTOGRAPHIC OPERATIONS 

Honorable Commissioner of Patents and Trademarks 
Washington, D.C. 20231 

PRELIMINARY AMENDMENT 

Sir: 

Prior to calculation of the filing fee and examination, 
please amend the above- identified application as follows: 

IN THE CLAIMS 

Please amend claim 4 as follows: 

Claim 4, line 1, change "one of the preceding Claims" to 
- -Claim 1- - . 

REMARKS 

The claims are amended to remove multiple dependency 
without change in scope. 
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Entry of the Amendment is respectfully requested. 




Daniel J. Piotrowski, Reg. 42,079 
Attorney 
(914) 333-9624 
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Encoding method for carrying out cryptographic operations. 



Technical field 

The invention relates to an encryption method as disclosed in the introductory 
part of Claim 1 , wherein at least one cryptographic sub-operation is performed on digital data 
stored as at least one data bit word in a storage cell or a register. 
5 State of the art 

Cryptographic operations are carried out in many data processing apparatus so 
as to protect the operation of such apparatus or the data transported in the apparatus. The 
arithmetic operations required for this purpose are carried out by standard processors as well 
as by dedicated crypto processors. A typical example of the latter processor is formed by a 

1 0 chip card or an IC card. For such cryptographic calculations it is often necessary to initialize 
relevant storage sections or registers of the data processing apparatus with operands. Data or 
intermediate results used in this context customarily constitute security-relevant information 
such as, for example, cryptographic keys or operands. 

In order to calculate the cryptographic algorithms, logic combinations of 

1 5 operands or intermediate results are formed in the data processing apparatus. Depending on 
the technology used, such operations, notably the loading of empty or previously erased 
storage sections or registers with data, lead to an increased current consumption of the data 
processing apparatus. In the case of complementary logic, for example CMOS, an increase of 
the current consumption occurs when the value of a bit storage cell changes, i.e. when its 

20 value changes from "0" to " 1 " or from " 1 " to "0". The increase of the consumption is then 
dependent on the number of bit positions changed in the memory or register. In other words, 
the loading of a previously erased register causes an increase of the current consumption 
which is proportional to the Hamming weight of the operand (= number of bits having the 
value "1") written into the empty register. Analysis of this current variation could thus enable 

25 extraction of information concerning the operations executed, thus enabling successful crypto 
analysis of secret operands such as, for example, cryptographic keys. When several current 
measurements are performed on the data processing apparatus, adequate information could be 
extracted, for example in the case of very small signal variations. On the other hand, a 
plurality of current measurements could also enable a possibly required differentiation. This 
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type of crypto analysis is also called "Differential Power Analysis" whereby an outsider 
could successfully perform a possibly unauthorized crypto analysis of the cryptographic 
operations, algorithms, operands or data purely by observing changes in the current 
consumption of the data processing apparatus. 

5 EP 0 482 975 Bl discloses a memory card which includes a microcircuit and 

at least one memory which is connected to a data processing member, the data processing 
member being controlled by a data signal from outside the card and delivering a command 
transmission signal in response to said data signal, at a given instant, said command 
transmission signal being delayed by a predetermined period of time (T) relative to the 

10 reception of the data signal, the period of time (T) being selected so as to be variable in time 
on a random basis in order to enhance the security. Crypto analysis on the basis of a current 
variation during the writing of the memory, however, cannot be precluded by such a system. 

Implementation of the invention, object, solution, advantages 

15 It is an object of the present invention to provide an improved method of the 

kind set forth which eliminates the described drawbacks and effectively prevents crypto 
analysis by observation of current consumption of a data processing apparatus. 

This object is achieved by means of a method of the kind set forth which is 
characterized as disclosed in Claim 1. 

20 To this end, in conformity with the invention a data bit word generated on the 

basis of random numbers is stored in a storage cell before a data bit word is written therein. 

This offers the advantage that there is a non-predetermined or non- 
predeterminable pre-initialization which prevents information concerning the data bit word 
written into the memory cell from being extracted on the basis of variations of the current 

25 consumption during the writing into the storage cell. During the writing of data in such pre- 
initialized storage cells the current consumption changes exclusively in dependence on a 
difference between the Hamming weight of the written data and the unknown random 
number, so that this difference, and hence also the variation of the current consumption, is of 
a random nature and cannot be determined in advance. 

30 There are various possibilities for the implementation of the method. 

According to a preferred version, the bit word based on random numbers is written into the 
storage cell by a processor. Alternatively, the bit word based on random numbers is written 
into the storage cell via a direct connection between a random number source and the storage 
cell. 
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Temporal correlation between the writing of the random number into a storage 
cell and the cryptographic sub-operation is avoided in that the bit word based on random 
numbers is stored in the storage cell at an instant in time which precedes the cryptographic 
sub-operation. 

5 

Brief description of the drawings 

The invention will be described in detail hereinafter with reference to the 
accompanying drawings. ThejimgleJEigure thereof shows a flow chart concerning a preferred 
version of the method according to the invention. 

10 

Preferred implementation of the invention 

As is shown in the sole Figure, a storage cell 10 or a register is provided for 

the writing and storage of data Xi in the form of a data bit word via a connection 1 1 . 

However, before the operand xj is written into the storage cell 10, a random number source 
15 12 generates random numbers which are written or stored, via a direct connection 1 4, into the 

memory cell 10. In other words, the storage cell 10 is initialized by way of a random value rj. 

Alternatively, the random value n can also be written, via the connection 1 1, by a processor 

having previously received the random value from the random number source 12. 

The instant of pre-initialization can be selected at random and preferably does 
20 not directly precede the cryptographic operation. Preferably, repeated pre-initialization of the 

storage section or register is performed with varying random numbers. 

When the storage sections or registers thus pre-initialized are loaded with data 

x; in the course of a cryptographic operation, the current consumption will change exclusively 

in dependence on a difference between the Hamming weight of the operand x { and the 
25 Hamming weight of the unknown random number. It is impossible to extract information as 

regards the operands used or intermediate results on the basis of such a random difference 

value. 
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CLAIMS: 



1 . An encryption method wherein at least one cryptographic sub-operation is 
performed on digital data stored as at least one data bit word in a storage cell (10) or a 
register, characterized in that 

a data bit word generated on the basis of random numbers is stored in a storage cell (10) 
5 before a data bit word is written therein. 

2. An encryption method as claimed in Claim 1, 
characterized in that 

the bit word based on random numbers is written into the storage cell (10) by a processor. 

10 

3 . An encryption method as claimed in Claim 1 , 
characterized in that 

the bit word based on random numbers is written into the storage cell (10) via a direct 
connection between a random number source (12) and the storage cell. 

15 

4. An encryption method as claimed in one of the preceding Claims, 
characterized in that 

the bit word based on random numbers is stored in the storage cell (10) at an instant in time 
which precedes the cryptographic sub-operation. 
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The invention proposes an encryption method wherein a cryptographic sub- 
operation is performed on digital data which are stored as at least one data bit word in a 
storage cell (10) or a register and wherein successful crypto analysis by observation of 
current consumption of a data processing apparatus is effectively prevented by writing a data 
bit word based on random numbers into a storage cell (10) before a data bit word is written 
therein. 
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IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 




In re Application of 



Atty. Docket 



STEFAN PHILIPP 



PHD 99-100 



Serial No. 



Group Art Unit: 



Filed: 



CONCURRENTLY 



Examiner: 



ENCODING METHOD FOR CARRYING OUT CRYPTOGRAPHIC OPERATIONS 



Honorable Commissioner of Patents and Trademarks 
Washington, D.C. 20231 



APPOINTMENT OF ASSOCIATES 



Sir: 



The undersigned Attorney of Record hereby revokes all 
prior appointments (if any) of Associate Attorney (s) or Agent (s) in 
the above -captioned case and appoints: 



c/o U.S. PHILIPS CORPORATION, Intellectual Property Department, 580 
White Plains Road, Tarrytown, New York 10591, his Associate 
Attorney (s) /Agent (s) with all the usual powers to prosecute the 
above- identified application and any division or continuation 
thereof, to make alterations and amendments therein, and to 
transact all business in the Patent and Trademark Office connected 
therewith. 

ALL CORRESPONDENCE CONCERNING THIS APPLICATION AND THE 
LETTERS PATENT WHEN GRANTED SHOULD BE ADDRESSED TO THE UNDERSIGNED 
ATTORNEY OF RECORD. 



DANIEL J. PIOTROWSKI 



{Registration No. 42jjizaj 




Jack E. Haken, Reg. 26,902 
Attorney of Record 



Dated at Tarrytown, New York 
this 24TH day of MAY, 2000 
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COMBINED DECLARATION FOR PATENT APPLICATION AND POWE 
(includes Reference to PCT International Applications) 




As a below named inventor, I hereby declare that: 

My residence, post office address and citizenship are as stated next to my name. 

believe I am the original, first and sole inventor (if only one name is listed below) or an original, first and joint inventor (if 
entitled: "Encoding method for carry 
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plural names are listed below) of the subject matter which is claimed and for which aa patent is sought on the invention 
entitled: "Encoding method for carrying out cryptographic operations" 



the specification of which (check only one item below): 

□ is attached hereto. 

□ was filed as United States application 

Serial No 



and was amended 



|pf was filed as PCT international application 
lumber PCT/EP99/07019 



20 September 1999 (20.09.99) 



:and was amended under PCT Article 19 



. (if applicable). 



;| hereby state that I have reviewed and understand the contents of the above-identified specification, including the 
Claims, as amended by any amendment referred to above. 

4 acknowledge the duty to disclose information which is material to the examination of this application in accordance with 
Title 37, Code of Federal Regulations, § 1.56(a). 

I hereby claim foreign priority benefits under Title 35, United States Code, § 1 19 of any foreign application(s) for patent 
or inventor's certificate or of any PCT international application(s) designating at least one country other than the United 
States of America listed below and have identified below any foreign application(s) for patent or inventor's certificate or 
any PCT international application(s) designating at least one country other than the United States of America filed by me 
on the same subject matter having a filing date before that of the application(s) of which priority is claimed: 



PRIOR FOREIGN/PCT APPLICATION(S) AND ANY PRIORITY CLAIMS UNDER 35 U.S.C. 1 19: 



COUNTRY 



APPLICATION NUMBER 



DATE OF FILING 
DAY, MONTH, YEAR 



PRIORITY 
CLAIMED UNDER 
35 USC 119 



Germany 



19845096.6 



30 September 1998 



YES 



Germany 



19936890.2 



5 August 1999 



YES 
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U S DEPARTMENT OF COMMERCE -Patent and Trademarks Office 

(July 1994) 



Combined Declaration For Patent Application and Power of Attorney (Continued) 
(includes Reference to PCT International Applications) 


Attorneys Docket Number 

PHD 99.100 US 


POWER OF ATTORNEY: As a named inventor, 1 hereby appoint the following attorney(s) abnd/or agent(s) to prosecute this application and transact 
,all business in the Patent and Trademark Office connected therewith. (List name and registration number) 


Algy Tamoshunas Reg. No. 27J377 
: Jack E. Haken, Reg. No. 26,902 


Direct Telephone Calls to: 
(name and telephone number) 
(914)332-0222 
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FULL NAME OF 
INVENTOR 


FAMILY NAME 


FIRST GIVEN NAME 

Stefan 


SECONDE GIVEN NAME 


RESIDENCE & 
CITIZENSHIP 


C1TY nr 
Hamburg J^>f-^ 


STATE OR FOREIGN COUNTRY 

Germany 


COUNTRY OF CITIZENSHIP 

Germany 




POST OFFICE 
ADDRESS 


POST OFFICE ADDRESS 

Eimsbiitteler Chaussee 47 


CITY 

20259 Hamburg 


STATE & ZIP CODE/COUNTRY 

Germany 




FULL NAME OF 
INVENTOR 


FAMILY NAME 


FIRST GIVEN NAME 


SECONDE GIVEN NAME 
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RESIDENCE & 
CITIZENSHIP 


CITY 


STATE OR FOREIGN COUNTRY 


COUNTRY OF CITIZENSHIP 




POST OFFICE 
ADDRESS 


POST OFFICE ADDRESS 


CITY 


STATE & ZIP CODE/COUNTRY 




FULL NAME OF 
INVENTOR 


FAMILY NAME 


FIRST GIVEN NAME 


SECONDE GIVEN NAME 




RESIDENCE & 
CITIZENSHIP 


CITY 


STATE OR FOREIGN COUNTRY 


COUNTRY OF CITIZENSHIP 




POST OFFICE 
ADDRESS 


POST OFFICE ADDRESS 


CITY 


STATE & ZIP CODE/COUNTRY 




FULL NAME OF 
INVENTOR 


FAMILY NAME 


FIRST GIVEN NAME 


SECONDE GIVEN NAME 




RESIDENCE & 
CITIZENSHIP 


CITY 


STATE OR FOREIGN COUNTRY 


COUNTRY OF CITIZENSHIP 




POST OFFICE 
ADDRESS 


POST OFFICE ADDRESS 


CITY 


STATE & ZIP CODE/COUNTRY 




FULL NAME OF 
INVENTOR 


FAMILY NAME 


FIRST GIVEN NAME 


SECONDE GIVEN NAME 


# 


RESIDENCE & 
CITIZENSHIP 


CITY 


STATE OR FOREIGN COUNTRY 


COUNTRY OF CITIZENSHIP 




POST OFFICE 
ADDRESS 


POST OFFICE ADDRESS 


CITY 


STATE & ZIP CODE/COUNTRY 




FULL NAME OF 
INVENTOR 
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FIRST GIVEN NAME 


SECONDE GIVEN NAME 
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RESIDENCE & 
CITIZENSHIP 


CITY 


STATE OR FOREIGN COUNTRY 


COUNTRY OF CITIZENSHIP 




POST OFFICE 
ADDRESS 


POST OFFICE ADDRESS 


CITY 


STATE & ZIP CODE/COUNTRY 



1 hereby declare that all statements made herein of my own knowledge are true and that all statements made on information and belief are believed to be 
true: and further that these statements were made with the knowledge that willful false statements and the like so made are punishable by fine or 
imprisonment, or both, under section 1 001 if Title 1 8 of the United states Code, and that such willful false statements may jeopardize the validity of the 
application or any patent issuing thereon. 


SIGNATURE OF INVENTOR 201 


SIGNATURE OF INVENTOR 202 


SIGNATURE OF INVENTOR 203 


date ~~Alp r i 1 20 ,J 2000 


DATE 


DATE 


SIGNATURE OF INVENTOR 204 


SIGNATURE OF INVENTOR 205 


SIGNATURE OF INVENTOR 206 


DATE 


DATE 


DATE 



U.S. DEPARTMENT OF COMMERCE- Patent and Trademarks Office 

(July 1994) 

PTO 



